emailengine-app 2.63.1 → 2.63.3

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [2.63.3](https://github.com/postalsys/emailengine/compare/v2.63.2...v2.63.3) (2026-03-05)
+
+
+### Bug Fixes
+
+* handle undici HeadersTimeoutError as transient in Pub/Sub and OAuth2 paths ([8b3b698](https://github.com/postalsys/emailengine/commit/8b3b69880ab09119df4ca377d085db261eae2763))
+* prevent IMAP worker crash on ImapFlow unhandled rejection during IDLE recovery ([86ebb02](https://github.com/postalsys/emailengine/commit/86ebb02c321ffa758966af1957509c10e20a35fc))
+* prevent transient network errors during OAuth2 token refresh from being misclassified as auth failures ([38fa212](https://github.com/postalsys/emailengine/commit/38fa212092847b727ac1d02541103c032a983dc7))
+* retry transient network errors in Gmail and Outlook API request functions ([08ea0da](https://github.com/postalsys/emailengine/commit/08ea0daecaec73c58a91ac07df5d0f0ffc083a2f))
+* treat DNS errors as transient in Google Pub/Sub polling loop ([ec33673](https://github.com/postalsys/emailengine/commit/ec33673b47242fd7156b4641c9c4924a33eaf9e5))
+
+## [2.63.2](https://github.com/postalsys/emailengine/compare/v2.63.1...v2.63.2) (2026-03-03)
+
+
+### Bug Fixes
+
+* harden static file route with path confinement and pkg-only guard ([19cd5f6](https://github.com/postalsys/emailengine/commit/19cd5f632baa7fb37f5d639f234c5374b371ab93))
+* prevent EISDIR crash on static subdirectory requests in pkg ([4d5ef81](https://github.com/postalsys/emailengine/commit/4d5ef81679e4fd7f5e8a55a260f2c29f99938ba4))
+* prevent infinite loop and add retry backoff in account assignment ([f8b9e53](https://github.com/postalsys/emailengine/commit/f8b9e533a821d1c34a869270fa489437ac80da93))
+
 ## [2.63.1](https://github.com/postalsys/emailengine/compare/v2.63.0...v2.63.1) (2026-02-26)
 
 

package/data/google-crawlers.json

@@ -1,5 +1,5 @@
 {
-    "creationTime": "2026-02-25T17:56:15.000000",
+    "creationTime": "2026-03-04T15:45:55.000000",
     "prefixes": [
         {
             "ipv6Prefix": "2001:4860:4801:2008::/64"

package/lib/email-client/base-client.js

@@ -538,6 +538,28 @@ class BaseClient {
                 });
                 accessToken = accountData.oauth2.accessToken;
             } catch (err) {
+                // Transient network errors are not authentication failures
+                let isNetworkError =
+                    err.code === 'ENOTFOUND' ||
+                    err.code === 'ETIMEDOUT' ||
+                    err.code === 'ECONNREFUSED' ||
+                    err.code === 'ECONNRESET' ||
+                    err.code === 'EAI_AGAIN' ||
+                    err.code === 'UND_ERR_CONNECT_TIMEOUT' ||
+                    err.code === 'UND_ERR_SOCKET' ||
+                    err.code === 'UND_ERR_HEADERS_TIMEOUT';
+
+                if (isNetworkError) {
+                    ctx.logger.error({
+                        msg: 'Network error during OAuth2 token refresh',
+                        account: accountObject.account,
+                        code: err.code,
+                        err
+                    });
+                    // Do not mark as authenticationFailed, let the caller handle as a connection error
+                    throw err;
+                }
+
                 err.authenticationFailed = true;
                 let notifyData = {
                     response: err.message,

package/lib/email-client/gmail/gmail-api.js

@@ -12,6 +12,18 @@ const LIST_BATCH_SIZE = 10;
 const MAX_RETRY_ATTEMPTS = 3;
 const RETRY_BASE_DELAY = 1000; // 1 second base delay
 
+// Network-level errors that are transient and should be retried
+const TRANSIENT_NETWORK_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ETIMEDOUT',
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'UND_ERR_SOCKET',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT'
+]);
+
 // Gmail API error code mapping to internal error codes
 // https://developers.google.com/gmail/api/reference/rest#error-codes
 const GMAIL_ERROR_MAP = {
@@ -117,6 +129,29 @@ async function request(context, url, method, payload, options = {}) {
         } catch (err) {
             lastError = err;
 
+            // Check if this is a transient network error
+            if (TRANSIENT_NETWORK_CODES.has(err.code) && attempt < maxRetries) {
+                const delay = RETRY_BASE_DELAY * Math.pow(2, attempt) + Math.random() * 500;
+
+                context.logger.warn({
+                    msg: 'Transient network error during Gmail API request, retrying',
+                    account: context.account,
+                    attempt: attempt + 1,
+                    maxRetries,
+                    delay,
+                    code: err.code
+                });
+
+                metricsMeta({ account: context.account }, context.logger, 'oauth2ApiRequest', 'inc', {
+                    status: 'network_error',
+                    provider: 'gmail',
+                    statusCode: '0'
+                });
+
+                await new Promise(resolve => setTimeout(resolve, delay));
+                continue;
+            }
+
             // Check if this is a rate limit error
             if (isRateLimitError(err) && attempt < maxRetries) {
                 const delay = calculateRetryDelay(err, attempt);

package/lib/email-client/outlook/graph-api.js

@@ -7,6 +7,18 @@ const { OUTLOOK_MAX_BATCH_SIZE, OUTLOOK_MAX_RETRY_ATTEMPTS, OUTLOOK_RETRY_BASE_D
 // Maximum number of operations in a single batch request to Microsoft Graph API
 const MAX_BATCH_SIZE = OUTLOOK_MAX_BATCH_SIZE;
 
+// Network-level errors that are transient and should be retried
+const TRANSIENT_NETWORK_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ETIMEDOUT',
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'UND_ERR_SOCKET',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT'
+]);
+
 // MS Graph API error code mapping to internal error codes
 // https://learn.microsoft.com/en-us/graph/errors
 const GRAPH_ERROR_MAP = {
@@ -163,6 +175,25 @@ async function requestWithRetry(context, url, method, payload, options = {}) {
         try {
             return await request(context, url, method, payload, options);
         } catch (err) {
+            // Retry on transient network errors
+            if (TRANSIENT_NETWORK_CODES.has(err.code) && attempt < maxRetries) {
+                lastError = err;
+                const delay = Math.min(OUTLOOK_RETRY_BASE_DELAY * Math.pow(2, attempt), OUTLOOK_RETRY_MAX_DELAY);
+
+                context.logger.warn({
+                    msg: 'Transient network error during Graph API request, retrying',
+                    account: context.account,
+                    attempt: attempt + 1,
+                    maxRetries,
+                    delay,
+                    code: err.code,
+                    url
+                });
+
+                await new Promise(resolve => setTimeout(resolve, delay * 1000));
+                continue;
+            }
+
             // Only retry on 429 (rate limit) errors
             if (err.oauthRequest?.status !== 429 || attempt === maxRetries) {
                 throw err;

package/lib/oauth/pubsub/google.js

@@ -203,7 +203,18 @@ class PubSubInstance {
             await oauth2Apps.setMeta(this.app, { pubSubFlag: null });
         } catch (err) {
             // Transient network errors are expected for long-polling connections
-            if (['ETIMEDOUT', 'ECONNRESET', 'ECONNREFUSED', 'UND_ERR_SOCKET', 'UND_ERR_CONNECT_TIMEOUT'].includes(err.code)) {
+            if (
+                [
+                    'ENOTFOUND',
+                    'EAI_AGAIN',
+                    'ETIMEDOUT',
+                    'ECONNRESET',
+                    'ECONNREFUSED',
+                    'UND_ERR_SOCKET',
+                    'UND_ERR_CONNECT_TIMEOUT',
+                    'UND_ERR_HEADERS_TIMEOUT'
+                ].includes(err.code)
+            ) {
                 logger.warn({ msg: 'Transient error pulling subscription messages', app: this.app, code: err.code });
                 return;
             }

package/lib/oauth2-apps.js

@@ -11,6 +11,17 @@ const Lock = require('ioredfour');
 const getSecret = require('./get-secret');
 const { parentPort } = require('worker_threads');
 
+const TRANSIENT_NETWORK_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ETIMEDOUT',
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'UND_ERR_SOCKET',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT'
+]);
+
 /**
  * Record metrics for OAuth2 token operations
  * Works in both main thread and worker threads
@@ -922,6 +933,10 @@ class OAuth2AppsHandler {
                 {name: 'projects/...'}
             */
         } catch (err) {
+            if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                logger.warn({ msg: 'Network error checking Pub/Sub topic', app: appData.id, code: err.code });
+                throw err;
+            }
             switch (err?.oauthRequest?.response?.error?.code) {
                 case 403:
                     // no permissions
@@ -964,6 +979,10 @@ class OAuth2AppsHandler {
 
                         results.pubSubTopic = topicName;
                     } catch (err) {
+                        if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                            logger.warn({ msg: 'Network error creating Pub/Sub topic', app: appData.id, code: err.code });
+                            throw err;
+                        }
                         switch (err?.oauthRequest?.response?.error?.code) {
                             case 403:
                                 // no permissions
@@ -999,6 +1018,10 @@ class OAuth2AppsHandler {
                 {name: 'projects/...'}
             */
         } catch (err) {
+            if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                logger.warn({ msg: 'Network error checking Pub/Sub subscription', app: appData.id, code: err.code });
+                throw err;
+            }
             switch (err?.oauthRequest?.response?.error?.code) {
                 case 403:
                     // no permissions
@@ -1042,6 +1065,10 @@ class OAuth2AppsHandler {
 
                         results.pubSubSubscription = subscriptionName;
                     } catch (err) {
+                        if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                            logger.warn({ msg: 'Network error creating Pub/Sub subscription', app: appData.id, code: err.code });
+                            throw err;
+                        }
                         switch (err?.oauthRequest?.response?.error?.code) {
                             case 403:
                                 // no permissions
@@ -1087,6 +1114,10 @@ class OAuth2AppsHandler {
                 }
             */
         } catch (err) {
+            if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                logger.warn({ msg: 'Network error checking Pub/Sub IAM policy', app: appData.id, code: err.code });
+                throw err;
+            }
             switch (err?.oauthRequest?.response?.error?.code) {
                 case 403:
                     // no permissions
@@ -1130,6 +1161,10 @@ class OAuth2AppsHandler {
                     { partial: true }
                 );
             } catch (err) {
+                if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                    logger.warn({ msg: 'Network error setting Pub/Sub IAM policy', app: appData.id, code: err.code });
+                    throw err;
+                }
                 switch (err?.oauthRequest?.response?.error?.code) {
                     case 403:
                         // no permissions

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "emailengine-app",
-    "version": "2.63.1",
+    "version": "2.63.3",
     "private": false,
     "productTitle": "EmailEngine",
     "description": "Email Sync Engine",
@@ -59,8 +59,8 @@
         "@postalsys/bounce-classifier": "^2.0.0",
         "@postalsys/certs": "1.0.12",
         "@postalsys/ee-client": "1.3.0",
-        "@postalsys/email-ai-tools": "1.11.3",
-        "@postalsys/email-text-tools": "2.4.1",
+        "@postalsys/email-ai-tools": "1.11.4",
+        "@postalsys/email-text-tools": "2.4.2",
         "@postalsys/gettext": "4.1.1",
         "@postalsys/joi-messages": "1.0.5",
         "@postalsys/templates": "2.0.0",
@@ -68,7 +68,7 @@
         "@zone-eu/wild-config": "1.7.3",
         "ace-builds": "1.43.6",
         "base32.js": "0.1.0",
-        "bullmq": "5.70.1",
+        "bullmq": "5.70.2",
         "compare-versions": "6.1.1",
         "dotenv": "17.3.1",
         "encoding-japanese": "2.2.0",
@@ -82,9 +82,9 @@
         "html-to-text": "9.0.5",
         "ical.js": "1.5.0",
         "iconv-lite": "0.7.2",
-        "imapflow": "1.2.10",
+        "imapflow": "1.2.12",
         "ioredfour": "1.4.0",
-        "ioredis": "5.9.3",
+        "ioredis": "5.10.0",
         "ipaddr.js": "2.3.0",
         "joi": "17.13.3",
         "jquery": "4.0.0",